How do I find out where a website is hosted?

Resolve the domain's A and AAAA records to get the addresses the site is served from.

Look up the network each address belongs to. Registry data identifies the organisation that holds the address block and the autonomous system that announces it.

For a cloud platform, that organisation is the cloud provider; for traditional hosting, the hosting company; for a site behind a CDN, the CDN.

Reverse DNS on the address sometimes names the provider or even the server, and sometimes names nothing useful.

Several addresses in different networks usually mean a CDN or an anycast service rather than several hosts.

A server header, where present, names the software and occasionally the platform.

CDNs add their own headers — cache status, request identifiers, edge location codes — which identify them even when the address alone is ambiguous.

Deployment platforms frequently add identifying headers of their own.

A Via header records proxies the request passed through.

Headers can be removed or altered, so they are evidence to weigh rather than proof.

Every public address then belongs to the CDN, and the origin server behind it is not named anywhere in the response.

That is intended: hiding the origin is part of what a CDN or a protection service provides.

Attempting to discover the origin behind such a service is attempting to defeat a protection, and it is not something to do to a site you do not operate.

For your own site, the CDN's dashboard names the origin; for someone else's, the honest answer is that the host is not public.

The registrar is where the domain is registered. It is visible in registration data and says nothing about where the site runs.

The nameservers show which provider answers DNS for the domain — often the registrar or a CDN, not the host.

The mail exchanger records show who handles mail, which is almost always a different service from the website.

A site can be registered with one company, use a second for DNS, a third as a CDN, a fourth for hosting and a fifth for mail.

Due diligence on a supplier, where the hosting provider and its jurisdiction matter to a data protection assessment.

Planning a migration, where the current platform decides what has to be moved.

Reporting abuse, where the network owner is the party able to act.

Inheriting a site whose documentation has been lost.

Understanding a performance or availability problem, where the provider's location and network explain latency.

An address in a cloud provider's network with no CDN headers usually means the site runs directly on that cloud, and the region is sometimes visible in reverse DNS.

An address in a CDN's network with the CDN's cache headers means the host is hidden behind it; the CDN is the answer the public side gives.

An address in a hosting company's network, a server header naming a common web server and reverse DNS naming the company points to conventional hosting.

Disagreement between the signals — a cloud address with another platform's headers — often means a platform that runs on top of a cloud provider, which is itself a useful answer.

Record which conclusion rests on which piece of evidence, since each can change independently when the site is reconfigured.